CIA INTERNAL USE ONLY 


Approved For RgJease 2001/09/03,: CHA-RDP84- os | 
P ihe Director of’Central Pte ioe he 


Washington, D.C. 20505 


Resource Management Staff DCI/RM 80-2412 
9 April 1980 


MEMORANDUM FOR: Director of Central Intelligence 


STATINTL FROM: 
Director, Information Resources Office 


SUBJECT: Project SAFE 


REFERENCES: A. Memo from D/IRO to DCI dtd 26 Mar 80, 

same subject (Tab A) 

B. Memo from D/ODP to DCI dtd 26 Mar 80 
Subject: Concerns Regarding SAFE (Tab B) 

C. Your memo of 21 March, Subject: Concerns 
Regarding 

STATINTL D. Memo from , Chairman, STAP 

to DCI dtd 18 Mar 1980, Subject: Questions 
Regarding SAFE 


1. Supplementing my memo to you, referenced above, I have 
again conferred with the Director, CSPO0, and he has furnished me 
with copies of Change Order No. 20 which was executed 27 March 
1980. This change order appears to me to adequately provide for 
the satisfaction of the requirement for the interconnection of the 
CIA and DIA SAFE systems for IOC. 


2. I have also had an opportunity to review the referenced 
memorandum to you from Bruce Johnson, D/ODP, and Clarus Rice, 
D/OCR, and I concur in the manner in which they respond to your 
concerns. 


3. As the project progresses, the I0C characteristics of the 
system are becoming defined with greater precision. Good manage- 
ment practice dictates that we proceed to I0C implementation 
without any substantial changes in the basic design concept. 
However, as pointed out in my previous memo to you on this 
subject, the design-to cost approach which was adopted has 
resulted in the necessity for deferring for later implementation 
some of the capabilities of the system embodied in the original 
design concept. I believe that the SAFE Project Office will soon 
be in a position to define fairly specifically which capabilities 
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will be deferred if current funding levels are adhered to. We are 
giving strong consideration to including this as an agenda item 
for our FY 82-86 Program Review. 


STATINTL 


Attachment: 
Tabs A & B 
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Washington, DC) 20505 


THO/MM 80-2408 
26 March 1980 


MEMORANDUM FOR: Director of Central Intelligence 


VIA: Deputy to the OCI: for Resource Management 

FROM: atl or 
Trector, Information Resources Office 

SUBJECT: Project SAFE 

REFERENCE: NS Your memo of 21 March, Subject: Concern 


Regarding SAFE (Tab A) 


8B. Memo from = Chairman, STAP 
to DCI dtd 18 Mar 1980, Subject: Questions 
Regarding SAFE (Tab B) 


Ll. I appreciate the opportunity to comment on the issues 
raised by the STAP Panel in. connection with the SAFE Project. As 
background to our comments, I should point out that last year, 
after discussions between the D/DCI/RM, the DDOCI, and DDA, it was 
determined that the focus of our interest in SAFE was to be "the 
areas of resource allocation and the relationship of SAFE to other 
programs on a -Community-wide basis."* Although we have continued 
to review the development of Project SAFE, our primary attention 
has been in accordance with the above quoted limitations.-. Conse- 
quently, we are not prepared to comment, except in general terms, 
on many of the concerns raised in the referenced STAP memorandum. 


2. Of the four principal concerns listed in your memo of 
March 21st, only one falls within the scope of IRO's responsi- 
bility as set forth in paragraph 1 above, namely: 


"What actions are. underway to ensure that the Intelli- 
qence Community has access to CIA SAFE and that CIA SAFE 


has access to DIA SAFE as well as such systems as COINS 
and SOLIS?" 


*Hemo from DDCI to D/DCI/RM dated 16 March 1979, Subject: Project 
SAFE > 
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be addressed Perouse? 


“20s. AE tie DCI'’s semiannual review in May 1979, it was 
Stated that a direct physical link between the DIA 
and CIA systems would be provided. 


o Our review of the Surrent version of the System 
Requirements Specifications indicates that such a 
communications connection between CIA and DIA-.SAFE 
systems is not included in.the specifications. 


o I have discussed this deficiency to.the attention of 
~ the SAFE Project Manager and he states that such a 
requirement will be added by amendment; that, 
although this has not yet been accomplished, such an 
amendment will be prepared in the near future. 


— &, We believe that it is crucial to the ultimate development 
of the types of intercommunication which are set out in your 
subject memorandum that this requirement be now formalized in the 
SAFE documentation since, if properly specified, it will provide 
the technical capdbility to enable: 


o CIA analysts to access DIA files. 


o CIA analysts to access other Community files 
through the OIA SAFE interface with the COINS 
network which is included in the current 
requirements documents. 


o DIA analysts to access CIA SAFE files 


o Analyst to analyst communications between DIA 
and CIA analysts. 


o The capability to permit other Intelligence 

Community components to access CIA SAFE facilities 

by going througn the DIA PGE pec with the COINS. 

or AUTODIN networks. 
5. It should be noted that the provision of the physical 
‘links and the technical capabilities to accomplish the above 
listed functions wtl} not, in and of itself, result in the 
implementation of any of these functions. None of the SAFE 
documentation, either emanating from DIA or CIA, calls for these 
functions to be provided. Indeed, the original CIA SAFE cocu- 
mentation specifically provides that the CIA SAFE system will be a 
closed system accessible only by CIA personnel. The position has 
been taken by some that CIA has no vatidated requirement for 
access to any-non-ClA system, including DIA SAFE. The results of. 
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the IHC-sponsored Analyst Support Study indicate that this is 
probably not the case. Nearly half of the CIA analysts 
interviewed said they. regularly access outside data bases such as 
SOLIS, the COINS files, CIRC II, and the NPIC data system. 
Furthermore, analyst-to-analyst communication across agency lines 
was ranked the second most important source of information by CIA 
analysts and the most important source by DIA analysts. As 
automated systems develop and improve and analysts become 
increasingly confident in their use of and reliance upon direct 
access to automated systems, requirements for and the value of 
access to external systems should increase still further. 


6. The management of the Consolidated SAFE Project Office is 
working under a handicap in this area. There has been, to our 
knowledge, no extensive formal review or update of CIA's 
Functional requirements on the user side since the decision was 
made to combine the two programs. Without any formal statement of 
requirements from the CIA analytical community (primarily NFAC) 
which the system is designed to support, it is difficult for those. 
charged with designing and implementing the system to anticipate 
what those needs may be. Therefore, we suggest that either you or 
some other appropriate authority should give to the SAFE Project 


Office some appropriate guidance which addresses these areas of 
concern. 


7. We would call to your attention the fact that providing 
any access to the CIA system from DIA and more especially from 
elements of the Intelligence Community outside of DIA raises 
serious security issues. The resolution of these issues will 
probably require action on your part to modify the present 
interpretation of existing security policies, or in some cases 
amendments thereto. If you should decide that the combined SAFE 
systems should provide the types of intercommunication and outside 
access which are outlined in your areas of concern, then someone 
(possibly the Computer Security Subcommittee of the DCI Security 
Committee) should probably be tasked with the responsibility of 
defining the security issues, suggesting possible solutions, and 
performing appropriate risk analyses so that they may be submitted 
to you for resolution. If this is undertaken, IRO should probably 
be involved in some way since decisions on these issues will* 
undoubtedly have major long-term effects on the feasibility of 
improving the interagency exchange of information and could aiso 
have a substantial impact on the resources which will be needed to 
satisfy Community ADP requirements. 


8. General comments on other concerns expressed by you based 
upon our limited perspective are: 


3 
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9. 
you of two initiatives we are taking in conjunction with the IHC 
which may have an impact on the future development of SAFE. 


0 


We are informed that [a of OCR is coordinating 


the CIA user interface with the CSPO; that he jis 
completely aware of the status of the project and 
consults regularly with the CSPO. 


In the development of a project such as SAFE, it is 
extremely important that a well defined single point 
of contact between the users and developers be 
established and maintained. Otherwise, the system 
developers will be faced with conflicting statements 
of requirements. 


If, in fact, the established lines of communications 
with the users are not adequate, perhaps the reason 

is attributable to a lack of an effective framework 
within NFAC to provide a continuing review of SAFE 

as it develops. If this is the case, we are not aware 
Of 1; 


We see no evidence that "major portions of the 
proposed operational capabilities are unspecified." 
It is, however, probably true that NFAC should direct 
more attention to the general issue of what its 
requirements for open source material are and how 
these should be met, either through SAFE or other 
means. 


The decision to place SAFE on a desiqn-to-cost basis 


necessarily implied some scaling down of the original 
requirements for the initial version. In consonance 
with this, NFAC did review and set priorities on the 
original SAFE requirements. 


It is our assessment that the CSPO is proceeding with 
development so that NFAC's highest priorities will be 
met first and the design will accommodate the later 
addition of those functions which now enjoy a lesser 
priority. 


If some of the capabilities which this approach will 

require to be deferred are considered to be important 
enough to warrant it, NFAC should develop a justifi- 

cation for their inclusion in the initial version of 

SAFE and the issue should be addressed during program 
review. 


In conclusion, I would take this opportunity to inform 


Approved For Release 2001/09/03 : CAA-RDP84-00933R000500120011-4 


CIA INTERNAL USE ONLY 


21 AR OSL GOORIN iN JA AEN RERERN chem TNA 


GHA INTERNE! Usk UNG 


wae 


Approved For Rétedse 2001/09/03 : CIA-RDP84-00933R0#500120011-4 


0 The development of a user language for SAFE will 
result in a common user language for DIA & CIA. 
We are exploring the possibility that this could 
become the initial step for developing user language 
standards for use throughout the Community. This will 
require the cooperation of the SAFE Project Office 
if it is to succeed. , 


o We expect the IHC to recommend the development 
of a distributed system of bibliographic informa- 
tion storage and retrieval systems. If this is 
to be done, the facilities of both the DIA & CIA 
SAFE systems in this area will have to function, 
as part of an overall Community system. If this 
is to be accomplished, the interconnection of 

the two systems could taken on added importance. 
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MEMORANDUM FOR: Director of Central Intelligence 


1 ee 


VIA: Deputy Director for Administration 
Director, National Foreign Assessment Center 


pe a 


FROM: Bruce T. Johnson 
Director of Data Processing, IDA 


Clarus W. Rice . 
Director of Central Reference, NFAC 


pene IL 


SUBJECT: Concerns Regarding SAFE 
; REFERENCE: Your memo dtd 21 March 1980, same subject 
' 


(ExReg 80~-754/1) 


bees tines 2 ARBRE 


1 1. This memorandum responds to your query of 21 March 
1980, transmitting some questions about SAFE posed by your 
Science and Technology Advisory Panel (STAP). 


2s Attached are answers to the specific questions 

{ raised by the STAP, presented in a narrative form reflect- 

i ing the complexity of some of the issues they addressed. 

i These answers represent the coordinated views of OCR and 

| ODP, reviewed and endorsed by the DDA and the Director, NPAC. 
| 


: a At our meeting with you, now scheduled for 3 April, 
TATINTL ace i : i 
we propose that Mr. Director of the Con-~ 
i solidated SAFE Project Office (CSPO), present. a Lrief 
summary which addresses the four concerns ycu list in your 


Memorandum, after which we will be prepared to elaborate on 


; any of those or other STAP questions about SAPM. We will 
ean also have available i _ Chief of OCR's Systems | 
; Analysis Staff, to discuss NFAC's extensive efforts to iden- 


{ tify user requirements. 
STATINTL 4. Wo understand that Messrs. es 
i” will be at the meeting, and welcome the opportunity to 
g . 


discuss. their questions with them. We would like to suggest, 
however, that it may be profitable for us to spend some 
additional time with them subsequent to our joint meeting 
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SUBJECT: Concerns Regarding SAFE 


with you, to supplement the one short briefing previously 
provided for them by SAFE's managers. 


/s8/ Bruce T. Johnson 
Bruce T. Jolinson 


CONCUR: 


le 


cee 


Deputy Director for Administration 


STATINTL 


2G MAR 1980 


Date 


Attachments: a/s 


eee Colo 


Distribution: 

Orig - DCI w/att. 

L ~ DDCI w/att. 

- Exec. Reg. w/fatt. 
- D/NEAC w/att. 
~ DDA w/att. 
D/CSPO W/att. 
- D/OCR w/att. 
- D/ODP w/fatt. 
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CONCERN : - 


2.0 How is SAFE management ensuring that a final working 
system has been developed from the continuing evolution of 
an operationally valid pilot system? How has SAFE taken 
advantaye of the experience of similar, very large systoms 
in their: 


1) system architecture, 
2) communication and control, and 
3) changing performance requirements? 


How 1s SAFE management ensuring that the system will: 


1) make available data on operation and usage of the 
pilot system to guide development; 
2) be able to modify both system functions and interaction 
capabilities so as to meet changing and evolving . 
requirements; and 
3) be able to add new functions and interactions so as 
to meet new requirements. 


RESPONSE: 


2.0 The “operationally valid pilot system" from which 
evolution will take place is the system which will he 
delivered at IOC in December.1982., Experience with the 
"Interim" SAFE system inaugurated in 1973 is being used 

in building the operational. system. Data and usage patterns, 
message and query analyses as well as user reactions are 
used in requirements specifications, system Sizing, function 
allocation and usaye scenario development. In order to 
ensure adaptability to changiny needs and growth, we have 
dictated the maximum use of general-purpose computers and 
software. 


The system architecture proposed_is the result. of an 
18 month design competition between a... is baseBTATINTL 
on asl and Government experience with large systems. It 
distributes communications and control functions as well 

as file processing such that bottlenecks are avoided and 

parallel expansion is possible without redesign. New 


functions may be added at either the top or mid-level 


processors. Funetions may be moved between levels to 
compensate For loading or usage changes. 


We expect the initial system to have shortcomings. 
All major systems do. We expect, however, the initial 
system to provide significant improvements in service and 
value over thé current environment. 
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Response to Questions and Comments from Science and Vechnolocdy 
Advisory Panel Memovandum of 18 Narch 1980. 


CONCERN: 


1.0 What steps are being taken to ensure that the Agency, 
rather than the contractor is in control of the technical 


aspects of the design of the system? 


RESPONSE: 


1.0: The Agency has in place a Strong technical management 
team. The contract effort is under control and the noeds 
of two Agencies are being addressed successfully. [En 
recognition of the problems of technical communication and 
management control compounded by geographic separation 

a number of steps have been taken as follows: 


a) The Government has contracted for a system davelopment 
rather than technical effort. The contractor is 
responsible for that development with government 
controls. The Government defines the functions 
and performance of the systcen as seen from a user's 
perspective. The development is performed to 
government requirements specification in accordance 
with NLL Stds. 490 and 1521 with yovernmont APPY OOTATINTL 
required of all specifications and dasigns. The 
Government approves all solicitation dociuuents, 
evaluation plans and contract awards by 


b) Monthly formal project reviews are conducted by the 
Consolidated SAFE Project Office (CSPO). ‘echnical 
staff interaction daily by phone and virtually 
continuously through travel maintains communication. 
The contractor has several permanent representatives 
located in Rosslyn, headed by a deputy project 
manager for East Coast operations. 


¢) Delays in decision making are not geographical 

problems. They are problems associated with hard 
choices. An on-site representative could provide 
oversight and some guidance but those problems of — 
Larger scope are not one-man problems. A full. time 
government representative is being considered for 
transfer to California. Travel will continue to 

be heavy in any event. 
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2.0 — Continued 


The cautionary note in the STAP memorandum is well 
founded. We should expect to take up to a year to introduce 
the system services after which the system will continue 


‘to evolve. The SAFE budget for 1982 and beyond recognizes 


this process. 
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CONCERN: 


3.0 The SAFE user community consists of Intelligence 
Community analysts covering the full spectrum.of research 
into foreign political, military, economic, scientific, 
and technological activity. Their effective use of this 
System and, ultimately, the quality of intelligence they 
produce rest on whether their real needs can be identified 
and satisfied by the system. 


RESPONSE: 


3.0 There has been more user involvement in the definition 
of the SAFE System than in any compuler system of which we 
are aware, The interaction is continuing to refine and 
revalidate the system functions with the user. The CSPO 
maintains the balance of interactions with the contractor 


and - through OCR's System Analysis Staff and DIA's user 
points of contact - the users. 


The Consolidated SAVE Requirements Document, which is 
the foundation of the technical development, was developed 
with and largely by the using NFAC and DIA community. 


In the CIA this work began in 1972 and has included: 


fe) Pilot groups of 50 analysts defining useful 
. functions a 
O Pilot systems development in 1973/4 
Oo Pilot branches to date provide usage data 
© User workshops in 1975 
oO 600 analyst survey in 1976 
fe) SAFE Procedures Development Laboratory 
Oo . Project Upstairs/Downstairs With ansiyex 
e) Newsletters 
fe) Direct interaction with CSPO and contractor of 


NPAC user representatives 
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3.0 continued 


In DIA there are 29 points of contact in user organizations 
who provide advice on requirements and are fully informed of 
project status. An extended data collection effort from 
1977 to-the present has developed user requirements which 


have been staffed with top level user management. 


All data gathered on the interim System usage and 
voluminous data on DIA's DIAOLS system have been Forwardcud 
to All prior study material has likewise been forwarded. 
These data are used to develop system design and flow threads. 


Four former analysts are resident in the CSPO to focus 
and control the flow of requirements and to ensure that they 
are met. This group coordinates heavily with both Agencies, 


—— 


We believe that a "community" system should be developed 


after SAVE and that. SAFE would be a prototype for replication 


and potentially be a node in a conmunity network. _ 
Training of users, Operators and instructors is part. .Of 

the system development contract. Both the Office of Training 

and NFAC will have instructors trained to support continuing 

operations and expansion of the user community. The Office 

of Data Processing will have operations personnel trained ag 

a part of this effort. 
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CONCERN: 
4,0 How can the Agency make a reasonablic evaluation of the 


current status of SAFE with major portions of the proposed 
operational capabilities either unspecified or unconmunicated 


_to the Agency? For example, 


1} the user command language and its parsing, 

2) the user programming language, 

3) the user editing languages, and 

4) procedures for backup, including regeneration of 


derived files lost in crashes. 


RESPONSE: 


4, All operational capabilities required, including user 
languages and backup capabilities, are specified in the 
Consolidated SAFE Requirements bocument written by the 
Government, The contractor's translation of those capabillitics 


to system design are encompassed in numerous system, sub-systen 


and clement specifications. These are. being developed on 
schedule with a normal amount of difficulty. Problems are 


' addressed early in the process and corrective action is taten. 


For example, the plan for language development was delayed 
due to misunderstandings which required several meetings. 
This effort is now on the road to satisfactory resolution. 
Contract schedule, cost and manajyement are all monitored 
for signs of difficulty. 


Approved For Release 2001/09/03 : CIA-RDP84-00933R000500120011-4 


Bi 


oe. 


lbh ee I RN 


Approved For @gJease 2001/09/03 : CIA-RDP84-00933%a#00500120011-4 


CONCERN : 


5.0 What actions are under way to insure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has 


ACCESS 
to DIA SAFE as well as such systems as COINS and SOLIS? 


RESPONS!: 


5.0 The basic system requirement has been given the 
contractor to provide interconnection between the two Aqencics. 
Five lines will be provided with expansion capacity to 25 


woe 


The contro] of access, differing security clearance practices 


‘and control of limited access information will have toa be 


worked oul among the using and security organisations of the 
Agencies. With the security features of the system being 
developed, it is hoped that administrative procedures and 
software safeguards will be adequate. 


CIA SAFE consists of: 


o The private files, mail files, route files, and 
the other specific files in SAFE are desiyned to 
satisfy the needs of individual analysts and have 
limited meaning to other analysts. The tools 
that SAPE provides to manipulate these files _ 
can, however, be put to use by other Intelligence 
Community Agencies to satisfy the particular 
needs of their analysts. 


o The major Central File (RECON/AEBGIS) of the CTA 
portion of SAFE is under consideration for being 
accessible by Intelligence Community analysts. 


Portions of this file are already available on 
COINS. 


o The link between NFAC and DIA will be used initially 
as a tool to coordinate pe once reporting 
between the two agencies. bventually, file 
sharing may take place if deemed useful by 
individual analysts. 


Gonervalized comiunity access has nol been envisioned in 
the initial system and presents additional security and, 
more vitally, loading problems. As alveady noted in 
response to question 3 we note that a."commuinity" syste 1 
should be developed after SAFE and that SAFE would be a 
prototype for replication and potentially be a node ina 
comunity network. e 
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6.9 Newspapers, periodicals, and. monographs may _be input 
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6.0 How will SAFE deal with open source material? Will : 
material, either finished publications or field teporting, 
he. made available to the analyst through SAPE? How will SAFE . 
deal with current newspaper and journal entries? : 


RESPONSI: 


to SAFE by production and OCK analysts: the item is indexed 
into the computer data base and the item is stored either 
locally (drawer, etc.) or in the central microfilm store 

which is linked to SAFE. Commercial data bases such as 
MEDLINE, NYTIB, OCLC, NEXIS, SDC, will be accessible through 
an intermediary. Automatic conversion of selected "hard copy" 
open.source data to machine-readable form is under development. 


ee 


ee eee ee 


| 


is an input with both finished J reports and raw 


input supplied to SAFE. Wire services, if subscribed to, STATSPEC 


can be added either on-line or as separate collectors for 
periodic input to SAFE, 
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CONCERN: 
7.0 What steps are being taken to ensure that SAFF will be 
designed to allow collaborative usage? 


RESPONSE: 


Ts Teleconferencing will be a part of SAFE. This will be 
permitted between CIA and DIA as well as within cach Agency. 


The generalized routing function will also be used for 
staffing and coordination as well as for further dissemination 
of information. 


As noted in question 5, there are security and access 
questions yet to be resolved. 
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| CONCERN: | 
8.0 What steps are under way to ensure that 


of major hardware items, the 
existing Agency systems? 


in the procurenent 
se items will be compatible with 


RESPONSE: 


i 8, The question of compatibility is complicated by the fact 
] that the CIA and DIA have different hardware. CIA/OULP uses 
IBM compatible equipment while DIA uses nainly 25X1A 


Compatibility has been factored into the hardware Request for 
Proposal and a value has been established for cost evaluation. 


IBM compatible and vendors thus have a cost advantage 
25X1A : ; : 
roughly equivalent To anticipated cost of supporting varied 


architectures. 


| Interconnection between SAFE and existing systems in 
i each Agency is planned and is part of the contracted effort. 


j The interface software for SAFE has been considered as a 
direct contract cost. 
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